Opened 13 months ago
Last modified 7 months ago
#62604 new enhancement
Prevent false-positive in validate_callback() in REST API
| Reported by: |
|
Owned by: | |
|---|---|---|---|
| Milestone: | Awaiting Review | Priority: | normal |
| Severity: | normal | Version: | |
| Component: | REST API | Keywords: | has-patch |
| Focuses: | Cc: |
Description (last modified by )
Related: https://github.com/WP-API/docs/issues/194
'type' => 'string',
'validate_callback' => function( $should_be_date ) {
return preg_match( '/^\d{4}-\d{2}-\d{2}$/u', $should_be_date );
}
Above validation expects the parameter should be 'YYYY-MM-DD' format, but actually any string as "valid" because preg_match() returns 0(falsy value) for mismatch.
So, validation priority should be is_wp_error() -> "is true?" -> "else, invalid."
Concerns:
strpos() return 0 for match.
Change History (3)
Note: See
TracTickets for help on using
tickets.
Related: https://github.com/WP-API/docs/issues/194
'type' => 'string', 'validate_callback' => function( $should_be_date ) { return preg_match( '/^\d{4}-\d{2}-\d{2}$/u', $should_be_date ); }Above validation expects the parameter should be 'YYYY-MM-DD' format, but actually any string as "valid" because
preg_match()returns 0(falsy value) for mismatch.So, validation priority should be
is_wp_error()-> "is true?" -> "else, invalid."Concerns:
strpos()return 0 for match. This result as false-negative in terms of backward-compatibility.https://core.trac.wordpress.org/ticket/62604#ticket
Trac ticket: